CVE-2026-10073

HighCVSS 7.5/10Last modified Jul 21, 2026

Description

DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing unauthenticated local attackers to exploit Relative Path Traversal to download arbitrary system files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23

Affected software

Vendor	Product	Versions
Interinfo	DreamMaker	<= DreamMaker Java Composer 2.2

References

Timeline

Published: May 29, 2026
Last modified: Jul 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1007309.8A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authenticat CVE-2026-1007376.9Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to CVE-2026-1007397.3A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unkn CVE-2026-100744.9DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path Tra CVE-2026-1007409.9A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component CVE-2026-1007419.8Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allow CVE-2026-1007447.3A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpda CVE-2026-1007456.3A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of th CVE-2026-1007467.3A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/CVE-2026-1007476.5Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-par CVE-2026-1007488.8Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 CVE-2026-1007494.3Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopp